High severity · published Mar 16, 2021
CVE-2021-20218
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after
7.4
CVSS
1.3%
EPSS
No
On KEV
Description
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
A-mq Online · Redhat
All versions, or not specified · source: NVD
BO
Build OF Quarkus · Redhat
All versions, or not specified · source: NVD
CS
Codeready Studio · Redhat
12.0 · source: NVD
DM
Descision Manager · Redhat
7.0 · source: NVD
IC
Integration Camel K · Redhat
All versions, or not specified · source: NVD
JF
Jboss Fuse · Redhat
7.0.0 · source: NVD
KU
Kubernetes-client · Redhat
4.2.0 before 4.7.2; 4.8.0 before 4.11.2; 4.12.0 before 4.13.2; 5.0.0 before 5.0.2 · source: NVD
OC
Openshift Container Platform · Redhat
3.11 · source: NVD
PA
Process Automation · Redhat
7.0 · source: NVD